GAMABlawg

Tech. Intellectual Property. Digital Strategy. Corporate Affairs. Government. The Good Stuff.

[gamallp]

The Dolan Law Firm Files a Wrongful Death Lawsuit Against Uber Following NYE Crash

By Noah Johnson        

          Christopher Dolan, a well-known Bay Area plaintiff’s attorney, has filed a wrongful death suit against Uber stemming from a tragic New Year’s Eve accident. The accident involved a driver named Syed Muzzaffar, believed to be on the UberX system at the time of the crash. Mr. Muzzaffar was making a turn at Polk St. and Ellis St. in San Francisco when he struck and killed six-year-old Sofia Liu, and seriously injured Sofia’s mother and brother.

           In response to the crash, Uber quickly posted “the driver in question was not providing services on the Uber system during the time of the accident.” However, Mr. Muzzaffar’s attorney asserts that his client was logged into the UberX application, had previously picked up a rider that evening, and was waiting to be contacted by another passenger. This presents a question within a legal grey area that has yet to be tested in the peer-to-peer transportation industry. It is a grey area that Dolan will attempt to clarify in favor of his client with the wrongful death suit.

           Conspicuously, Dolan largely ignores any of the recently approved regulations by the California Public Utilities Commission (CPUC) that govern companies such as UberX and Lyft. Instead, the complaint focuses on a surprising source of legal authority: the California Vehicle Code (CVC). Specifically, the complaint states UberX compels drivers to violate CVC 23123.5, which prevents drivers from driving a vehicle while “using an electronic wireless communications device to write, send, or read a text-based communication.” The only exception to this regulation is if the device is specifically designed to allow voice operated and hands-free operation, and is actually used in this manner while driving. Additionally, the complaint cites CVC 26708, which restricts the usage of GPS devices to a seven-inch square in the lower corner of the windshield farthest from the driver, or in a five-inch square in the lower corner of the windshield nearest to the driver. Additionally, the regulation states that such a GPS system may only be used for door-to-door navigation while the motor vehicle is being operated.

           The complaint alleges that the business activity generated by UberX does not fall under the definition of door-to-door navigation in the CVC. Additionally, Dolan alleges that the UberX application is a GPS device within the meaning of the CVC and that it violates 23123.5 because it facilitates text-based communication.

           The complaint goes on to state that violation of these regulations caused Uber to breach a duty of reasonable care towards Sofia Liu and her family and that this breach was the proximate cause of the injuries to the family.

           Using the CVC is an interesting legal strategy. It is likely Dolan did not want to stand on the shaky legal ground the CPUC has established for companies such as UberX, Lyft, and Sidecar. The CPUC’s regulations left a number of liability questions largely unanswered. Instead, the firm wanted to find more established regulations that hold more weight with the court. While very few enforcement actions have been taken against private or personal drivers who are using their smartphones as GPS navigation devices, the fact remains that these CVC regulations are codified and technically in effect. While the regulations have not been applied to companies such as UberX to this point, Dolan is definitely forcing the issue in this high stakes case. It will be interesting to watch this case unfold as the future of liability in the transportation industry is decided.

Uber Sued over Death of San Francisco Girl on New Year's Eve by KQED News

[gamallp]

Gagnier's Paper Featured in Big Data and Privacy: Making Ends Meet

Read Christina Gagnier's paper published by the Future of Privacy Forum.

Big Data and Privacy Paper Collection

[gamallp]

Hunter Moore, the “Most Hated Man on the Internet,” Arrested for Revenge Porn Hacking

By Emily Poole

Hunter Moore, the founder of revenge porn website IsAnyoneUp.com, was arrested in California this week on federal charges of conspiracy, computer hacking and identity theft. Moore is alleged to have paid a man, Charles “Gary” Evens, to break into the email accounts of hundreds of victims to steal sexually explicit photos of the victims.

  According to a 15-page indictment, Evens used various means, including hacking, to gain access to victims’ email accounts. Evens would obtain nude photos of the victims and send the photos to Moore in exchange for payment. The indictment claims that Moore offered Evens additional money to obtain more nude photos of victims and that Moore posted these photos to his site without the victims’ authorization.

  A revenge porn website is a site where users can anonymously post or upload sexually explicit photos or videos of their exes without the consent of the pictured individual.  IsAnyoneUp.com, one of the first mainstream revenge porn sites, spawned various copycat sites. Creators of these similar sites soon learned how to turn revenge porn into a business—charging victims for the removal of the nude photos that their exes had uploaded.

  Until now, Moore has defended himself from legal responsibility for the explicit photos posted on his site with Section 230 of the Communications Decency Act. Section 230 shields online service providers, such as websites, from legal liability for the content posted by third parties. This means that, as the mere operator of the site, Moore was immunized by the actions of third parties—users that actually uploaded nude photos to IsAnyoneUp.com. It also means that the FBI must find another path to get at Moore. If the court finds Moore paid Evens to hack into victims’ accounts, or that Moore was actually one of users who uploaded photos to the site, the FBI might just have found the path it has been seeking.

Link to indictment: http://www.scribd.com/doc/201777072/Hunter-Moore-Charles-Evens-Revenge-Porn-Indictment

  Link to text of CDA: http://www.law.cornell.edu/uscode/text/47/230

[gamallp]

Attend GAMA's New Workshop Series On or Offline

Gagnier Margossian has launched a new workshop series in 2014, taking place in the San Francisco office as well online. Please see the list of workshop dates linked to more details below. Feel free to share with friends and colleagues. February 2014 2/3 - ABC's of Privacy and Security 2/11- The 411 on Independent Contractors 2/18 - DeveloperWeek Event: Legal Issues for Developers 2/24 - The 411 on Entertainment Law March 2014 3/3 - Get HIPAA/HITECH: Health Information Privacy Law for Startups 3/11 - Starting Your Own Business: The Legal Details 3/18 - What is Intellectual Property and How Do I Protect It? 3/24 - Venture Financing 101: The Legal Side

[gamallp]

Auto Makers at CES Introduce Driverless Cars, but Regulation may be Distant

By Guy Noyes

     Automobile manufacturers Audi and BMW unveiled new driverless cars at this year’s CES, but safety and privacy concerns at the regulatory level may put some roadblocks in their path. Regulators at the Department of Transportation in Washington D.C. have recently been working on new distracted driving rules to deal with the influx of computers into cars. The creation of the Open Automotive Alliance, a collaboration between companies including Google, chip manufacturer Nvidia, and carmakers Audi and GM, takes these issues to a whole new level. One goal of the Alliance is to have the Android operating system used to power internal car computers.

     Computer driven cars have the potential to offer tremendous benefits to the elderly and sight impaired. Issues surrounding the technology include questions of liability in the event of a car crash. David Strickland, of the National Highway Traffic Safety Administration spoke at the show, and mentioned that safety has to be “the number 1 priority.”

     As important as safety issues are, most ominous were the potential privacy concerns raised by the technology. Jim Farley, Executive Vice President of Global Marketing, Sales and Service and Lincoln, Ford Motor Company,  spoke about the data collected by the GPS in cars to the CES crowd, “We know everyone who breaks the law, we know when you're doing it. We have GPS in your car, so we know what you're doing.” He assured listeners that Ford does not share this information with anyone. Khaliah Barnes of the Electronic Privacy Information Center expressed worries that a lack of oversight of this data collection could lead to abuses.

     Senator Al Franken (D-MI) reiterated the need for legislation on this issue, referring to his location privacy bill, the Location Privacy Protection Act of 2012 (available here). The bill would prohibit companies from collecting geolocation data without the express authorization of the user.      On the other end of the spectrum, Hilary Cain, national manager for technology and innovation policy at Toyota Motor North America,expressed discontent with legislative regulation of industry. She argued that too much regulation and uncertainty would stifle innovation.

[gamallp]

Supreme Court Accepts Aereo Case Setting Up Landmark Copyright Decision

By Noah Johnson          

          On January 10, 2014, the Supreme Court granted certiorari in the case ABC, Inc. v. Aereo from the Second Circuit Court of Appeals. The case pits media heavyweights such as ABC Networks, the NFL and Fox Television against the New York City-based startup Aereo. Aereo was founded only two years ago in December 2011 and has already been involved in numerous high stakes legal battles.

           Aereo utilizes what some would argue is an ingenious business model. The company developed a tiny television antenna that picks up widely accessible TV signals from the major networks such as CBS, ABC, FOX and PBS. These signals would also be available to home consumers for free with an old fashioned TV antenna. Aereo replicates this concept by constructing hardware that houses thousands of individual TV antennas each assigned to an individual subscriber. Each antenna is then linked to an individual digital video recording (DVR) device. The user can use a program to login from anywhere to watch the prerecorded or streaming shows from their personal DVR device. In a nutshell, it is like TiVo but only for the major networks that are publicly accessible, and you can stream the content from anywhere in the world as long as you have Wifi.

An Aereo TV antenna compared to a dime:

           The major networks argue that if Aereo’s business model is allowed to stand, the entire broadcasting industry will be destroyed. Some networks have even threatened to completely shutdown if Aereo is not stopped by the Supreme Court. The networks contend that Aereo has “developed a business model around the massive, for-profit exploitation of the copyrighted works of others” in their petition to the Supreme Court. Currently, the networks make billions of dollars per year from cable and satellite companies who pay to retransmit the major channels and their lucrative programming.

           However, Aereo has thus far won all the major court cases it has faced. The Second Circuit Court of Appeals sided with Aereo based upon the technology they utilize and the statutory language of the Copyright Act. The Copyright Act defines a “public performance” of a copyrighted work as “transmitting . . . a performance . . . of the work . . . to the public, by means of any device or process . . ..” Aereo argues that they are not broadcasting a single “performance” to multiple users, instead they stream thousands of separate performances each to an individual subscriber and therefore not to the public. Broadcasters argue that Aereo is doing exactly what cable systems do when they re-broadcast programming to subscribers and have to pay licensing fees. Thus, Aereo should pay as well. Aereo instead argues that they are exactly like antennas that people can legally put on their own rooftops because each Aereo user is assigned a unique antenna and DVR.

           So far, the Second Circuit and U.S. District Courts in Utah and Massachusetts have all sided with Aereo. The issue is hotly contested and a large list of amicus curiae briefs have been filed with the Supreme Court from parties such as Major League Baseball and a consortium of law professors. It will be fascinating to see if the Supreme Court engages in a strict reading of the Copyright Act like the Second Circuit or if they take a more liberal approach by widely interpreting the phrase “public performance.” An opinion is likely in June or July 2014 and regardless of the outcome, it will have major implications for U.S. copyright law.

[gamallp]

Senators Propose New Data Security Regulations

By Guy Noyes

In the wake of the security breaches that occurred recently to Target and Neiman Marcus, Senators Tom Carper (D-Del.) and Roy Blunt (R-Mo.) proposed a new bill that would require businesses and government agencies to protect sensitive information of individuals and notify them if there is an increased risk of identity theft or fraud. A version of the bill is available here. Due to the nature of the definitions in the statute, any business that “maintains or communicates” information such as credit and debit card numbers could be affected by the bill.

  In the event of a data breach, companies and other organizations would have to determine how much and what type of information was acquired, and if the information could be used to harm a person. If the breach affects more than 5,000 consumers, the organization would also have to notify law enforcement, consumer reporting agencies and the federal government.

  The bill would replace the current state of affairs, where the differing laws of 49 states govern data security issues. Various states, such as California, have data breach notification requirements. However, the Data Security Act would be the first of its kind at the federal level. Senator Al Franken (D-Minn.) questioned credit card companies on their failure to implement stronger security measures used outside the U.S., noting that as a result, “the U.S. is a global center for card fraud.”

  Senate Judiciary Committee Chairman Patrick Leahy (D-Vt.) has proposed a different data security bill called the Personal Data Privacy and Security Act of 2014, full text of which is available here. Senator Leahy’s bill would require businesses to take measures to identify and limit security vulnerabilities to sensitive information, as well as requiring notification in the event of a breach If the breach affects more than 5,000 persons, Senator Leahy’s bill would require notice be given to credit reporting agencies and major media outlets. The bill also grants authority to the Federal Trade Commission to enforce the bill’s provisions.

[gamallp]

Appellate Court Strikes FCC’s Net Neutrality Order

By Jaison Mathew 

          On Tuesday, Verizon landed a judicial victory in the “net neutrality” debate as the D.C. Circuit Appellate Court ruled against portions of the FCC’s Open Internet Rules – specifically, parts which prohibit broadband Internet providers from selectively speeding up, slowing down or blocking content providers.

          Judge Tatel, while sympathetic towards FCC’s goal of “preserv[ing] the Internet as an open platform for innovation . . . competition, and free expression,” ruled that the FCC lacked statutory authority under the Telecommunications Act of 1996 to restrict broadband providers from charging content providers for accelerated bandwidth.

          The three-judge panel held that in spite of the Commission’s general authority to regulate Internet infrastructure, the Commission could not both classify broadband providers differently than common carriers and regulate broadband providers like common carriers.

          The Commission’s Open Internet Rules require broadband providers to be transparent in disclosing network management practices and terms of their service; they also prohibit broadband providers from blocking lawful content and from discriminating in transmitting lawful content over the end-user's Internet access service. Though the Commission does not expressly forbid broadband providers from granting preferred status to select content providers, the pay-for-priority model would likely violate the latter, anti-discrimination part of the rules.

          However, "net neutrality" is far from dead. The court opinion affirmed the Commission’s broad authority to regulate the infrastructure of the Internet. So, it may only be a matter of reclassifying broadband provider services under the Telecommunications Act, which would then allow the FCC discretion in regulating broadband providers as common carriers.

          FCC Chairman Tom Wheeler also said in a written statement that the Commission will consider appealing the recent decision to the Supreme Court.

[gamallp]

Yelp to Lobby Libel Law in Washington

By Jaison Mathew 

          Late last year, Yelp announced hiring its first lobbyist, Laurent Crenshaw, Rep. Darrel Issa’s (R-Calif.) former legislative director, to influence free speech and patent policy in Congress. Considering the work Rep. Issa has done surrounding intellectual property rights during Crenshaw’s tenure, it’s apparent why Yelp sought Crenshaw’s expertise.

          Mr. Crenshaw has reportedly been tasked with influencing policy surrounding Section 230 of the Communications Decency Act (CDA), federal anti-SLAPP, the DMCA and patent reform. 

          The San Francisco based public company has been connecting “people with great local businesses” since 2004. The site boasts a monthly average of over 100 million unique online visitors, making it a giant in the online reviews business. With written reviews totaling over 47 million, Yelp is understandably vested in the policy surrounding libel and the free expression. 

          Yelp and similar user-generated content (UGC) websites thrive due in part to Section 230 of the CDA, a law passed in the late ‘90s that shields online websites from lawsuits arising from user content. UGCs in the U.S. are privileged by lax defamation laws – especially in light of other countries’ strengthening their respective defamation laws. 

          However, Congress may soon weaken the CDA. Last year, the National Association of Attorneys General wrote a letter, signed by 47 State AGs, to Congress calling on amendments to the CDA in order to crack down on sex-trafficking. Despite their good intentions, placing strict liability on UGC sites for user behavior threatens Yelp’s existence. This may explain Yelp’s desire to play a larger role in the future of the CDA.

          Whatever the motivation for Yelp’s proactive politicking, the rating site seems to be following the lead of Facebook, Twitter, and other Internet companies who have, in recent years, hired experts to influence legislative policy.

          This, however, is not Yelp’s first foray into politics. In August, Yelp joined Facebook and Google in sending representatives to ALEC’s (American Legislative Exchange Council) tech task force to pursue anti-SLAPP legislation.

[gamallp]

Why You Should Consider a Founders' Agreement

A founders' agreement can help you avoid a messy divorce from your business partner. Here's what you need to know.

See coverage of GAMALLP's latest workshop for startup founders.

[gamallp]

Bitcoin Now Accepted at Overstock.com Despite Legal Uncertainty

By Noah Johnson

          Overstock.com began accepting Bitcoin today, becoming the first major U.S. retailer to accept the virtual currency. Many smaller companies accept Bitcoin, but Overstock.com, with its approximately $1.3 billion in yearly revenue, will immediately become the largest retailer to endorse the new form of payment. The move comes despite the ongoing legal grey area that surrounds Bitcoin.

           One major concern around the currency is the wildly fluctuating value of Bitcoin. Throughout most of 2013, Bitcoin’s value hovered around $100-$200 per coin. However, as a result of wider adoption and speculation, Bitcoin soared to nearly $1,300 per coin in December 2013. Only days after the all-time high, the Chinese Government banned Bitcoin from being traded by Chinese financial institutions and the currency lost nearly half its value by falling to $700.

           However, Overstock.com has sought to manage this risk by partnering with the San Francisco based startup Coinbase. Coinbase acts as an intermediary by accepting the Bitcoin at a set exchange rate for dollars and passing the dollar amount directly to Overstock.com. Coinbase then sells the Bitcoin it has amassed when it feels the exchange rate is high and holds the Bitcoin when the price drops.

           These developments have occurred as governments around the world are still determining how to regulate Bitcoin. The IRS is currently studying the matter and has yet to issue guidelines. Until guidelines are established, it is unclear how Bitcoin will be taxed. If Bitcoin is treated as a currency for tax purposes, any profits from sales of Bitcoin would be taxed as ordinary income with a rate as high as 39.6 percent.

           Bitcoin is also created through “mining” where users donate their computer power to facilitate worldwide Bitcoin transactions in exchange for the creation of “new” Bitcoin on their own system. Bitcoin mining has become a major business and these new stores of Bitcoin could be taxed as capital gains, or individual income. The government of Taiwan has gone as far as banning the installation of Bitcoin ATMs and publicly stating that Bitcoin should not be accepted by any individuals or banks.

           Despite these developments, the idea of virtual currency is here to stay. This recent post shows that a San Francisco based Hedge Fund has decided to hire a full time Bitcoin trader. As retailers such as Overstock.com and exchanges such as Coinbase bring Bitcoin into the mainstream, it may become harder for national governments to outright ban the use of Bitcoin. In the meantime, the entire Bitcoin ecosystem will wait to see how the IRS will address the virtual currency for the future.

[gamallp]

Massive Snapchat Data Breach Underscores Need for Privacy By Design

By Noah Johnson

           On Christmas Eve 2013, the organization Gibson Security posted portions of Snapchat’s source code online. The source code revealed weaknesses that allow hackers to download user information from the application. Within days, a website emerged that enables anyone in the world to download a database of 4.6 million usernames and associated phone numbers from Snapchat. The website even boasts “people tend to use the same username around the web so you can use this information to find phone number information associated with Facebook and Twitter accounts.” Thus began Snapchat’s first major privacy debacle. And it all could have been avoided.

           Gibson Security actually alerted Snapchat to the vulnerabilities months before. In August 2013, Gibson published an article online titled “Snapchat Security Advisory” that outlined the weaknesses. Feeling ignored by Snapchat, and claiming that they wished to protect users, Gibson Security published the full vulnerabilities in December for the world to see.

           Snapchat has now hired a large lobbying firm in Washington, D.C. to assist with communications efforts in the aftermath of the breach. The move to work with a lobbying firm also comes as privacy advocates are calling for the Federal Trade Commission (FTC) to investigate Snapchat and potentially levy fines. Interestingly, the advocacy group EPIC officially requested an FTC investigation of Snapchat in May 2013. In its complaint, EPIC urged the FTC to follow FTC policies requiring companies to “incorporate substantive privacy protections into their practices, such as data security, reasonable collection limits, sound retention practices, and data accuracy.” (EPIC Complaint Pg. 6). The EPIC complaint requested that “the Commission should require Snapchat to improve its data security practices.” (EPIC Complaint Pg. 7).

           The Snapchat data breach shows that young web companies need to take privacy by design seriously. When social media companies handle millions of pictures and videos per day, their users’ data security becomes just as important as securing a billion dollar buy out offer from Facebook or Google. It will be interesting to see if the FTC takes a more proactive role in policing technology companies and protecting consumer privacy in the wake of such a public privacy breach. In the meantime, private actors such as Gibson Security may keep the tradition of public interest security hacking alive where regulations fail to mandate safeguards.

Are you a Snapchat user? Use this database to see if your information was leaked.

[gamallp]

NYE Tragedy Highlights Important Ridesharing Legal Questions

By Noah Johnson

Just before 8p.m. on New Year’s Eve, a mother and her two young children were struck by an SUV while walking in a crosswalk at Polk St. and Ellis St. in San Francisco. One of the children, Sophie Liu, tragically died of her injuries at SF General Hospital. The other two individuals are expected to survive.

               In the midst of the tragedy, a complicating fact is that the driver, Syed Muzzafar, was an Uber partner and driver. According to a statement released by Uber, the “driver was not providing services on the Uber system during the time of the accident.” The driver’s account was deactivated once police released his name to the company. However, it is not clear whether the driver was operating in a grey area of service, such as being on his way to start offering rides or on his way home after offering rides on the UberX system. Both of these situations would lead to important questions as to whether Uber’s insurance, Mr. Muzzafar’s personal insurance, or potentially a separate transportation company that owns the vehicle, should cover the incident.

              Just months before this incident, in September 2013, the California Public Utilities Commission (CPUC) approved regulations that affect companies such as UberX, Lyft and Sidecar. The CPUC created a new legal designation for these companies, coining them “transportation network companies” (TNCs). According to the regulations, each TNC must maintain commercial insurance policies of at least $1,000,000 per-incident coverage for incidents involving vehicles and drivers while they are providing services (CPUC 74). Additionally, the CPUC ruling explicitly states that “no Term and Condition in a TNC’s Terms of Service or elsewhere, can be inconsistent with this decision’s commercial liability insurance requirements” and also states that no Term or Condition in a TNC’s Terms of Service can be used to deny insurance coverage following a driving incident (CPUC 75).

              In April 2013, Uber released its own white paper outlining their proposed ridesharing policies. The white paper states that Uber will provide a minimum of $1,000,000 per-incident insurance coverage to ridesharing trips taken with UberX. Uber defines such a trip as “any ridesharing trip requested through the Uber technology platform.” This implies that if Mr. Muzzafar was on his way to pick up an UberX passenger, even if the individual was not yet in the car, then UberX’s coverage would apply.

              The CPUC’s decision is a step forward for California’s users of ridesharing services. The decision at least mandates a minimum level of coverage for passengers while they are in the vehicle. However, the CPUC ruling does not shed light on the full extent of coverage for pedestrians struck by TNC drivers. Additionally, the ruling does not explicitly state when a driver has started and finished a TNC ride. The CPUC should address these issues as the TNC application and regulatory process continues. Unfortunately for Californians, it may take a court case to weave its way through the system before these questions are explicitly answered. Just such a case may exist, and this incident involving an Uber driver, a flying fire hydrant and an innocent bystander will be one to watch. 

[gamallp]

Get ready for the new year and new legal requirements.